Privacy Policy

---

Operator: Ayman (sole proprietor). Contact: publisher@webwiz24.com Product: TimeRecord, a Chrome extension and web app at timerecord.app

1. What we collect

From the Chrome extension (Free + Premium):

• Root domain (e.g., figma.com) of the active browser tab while the timer is ON.
• Page title of the active tab.
• Time durations associated with the user-selected Client and Task.
• Idle status from the browser (active / idle), never keystrokes or mouse content.

We never collect:

• Full URLs or query strings.
• Page contents.
• Domains the user has added to the privacy blacklist.
• Browsing data when the timer is OFF.

From the web app (Premium only):

• Email address (for authentication).
• Encrypted authentication tokens.
• Subscription status (received from Lemon Squeezy webhook).
• Your display name, auto-extracted from your OAuth provider (Google sign-in) on first login, or supplied by you when prompted on the dashboard. Stored to greet you and to label PDF reports / future invoices.

From the website (timerecord.app; analytics, consent-gated):

• We use Google Tag Manager to load Google Analytics 4, which measures aggregate, anonymized usage of the public website (page views, approximate location at country level, device/browser type). IP addresses are anonymized. We apply Google Consent Mode v2 with analytics and advertising storage denied by default: until you click Accept on the cookie-consent banner, no analytics or advertising cookies are set and no measurement data is sent. Clicking Accept updates consent to allow analytics; choosing Decline (or making no choice) keeps everything denied. Through the same Google Tag Manager container and the same consent gate, we also load PostHog (EU region) for product analytics (understanding which features are used and where users get stuck), keyed only to your account identifier once signed in; it likewise loads nothing until you Accept. This applies to the website and web app only; the browser extension contains no analytics or third-party trackers of any kind.

From the web app (Premium-only, Calendar Sync feature, opt-in):

• OAuth refresh and access tokens for any calendar provider you connect (Google Calendar, Outlook Calendar). Tokens are encrypted at rest with AES-256-GCM before being written to the database.
• The email address of the connected calendar account (so we can show you which account is currently connected).
• Calendar event metadata (event title, start time, end time, all-day flag) is read on demand from the provider when you view /dashboard/calendar or /dashboard. It is rendered in your browser and never persisted to our database.

2. Why we collect it

• To produce accurate timesheets, the core product feature.
• To authenticate Premium users.
• To process subscriptions (delegated to Lemon Squeezy as Merchant of Record).

Lawful basis under GDPR: performance of contract for paid features; legitimate interest for the free extension's local-only tracking.

3. Where data lives

• Free tier: entirely on the user's device via chrome.storage.local. Nothing leaves the browser.
• Premium tier: synced to our backend hosted in the EU (Supabase, region eu-central-1 / Frankfurt).
• Calendar sync (opt-in, Premium): OAuth tokens are stored encrypted at rest in our EU backend. Calendar event metadata is read on demand from your provider's API and is never written to our database. You can disconnect any time at /dashboard/settings → Calendar sync, which deletes the stored tokens and (best-effort) revokes them at the provider.
• Payments: Lemon Squeezy (Merchant of Record). They store name, billing address, and tax data; we receive only the email and subscription state.
• Operator access (administration): the service operator has technical read access to all stored account data (email, sign-up date, last sign-in, plan and subscription status, clients/projects/tasks/entries/invoices you create on the Premium tier, and any OAuth tokens you have connected) for the purposes of support, billing reconciliation, fraud prevention, and aggregate analytics. Operator access is gated to a small allowlist of operator user IDs and is mediated through the same database that powers your account. Operator access is never used to view individual users' content for any purpose other than the ones above.

4. Sub-processors

5. Your rights (GDPR)

• Access, rectify, delete, or export your data.
• Withdraw consent at any time.
• Disconnect any calendar provider at /dashboard/settings → Calendar sync. Disconnect deletes the stored OAuth tokens for that provider and (best-effort) revokes them with the provider.
• Delete your account at /dashboard/settings → Danger zone → Delete account. This permanently wipes your account and all associated data (clients, projects, tasks, time entries, profile, OAuth tokens, subscription record) via cascading delete.
• Lodge a complaint with your local Data Protection Authority.

To exercise any right, email publisher@webwiz24.com or use the in-app actions above.

6. Retention

• Free tier: until the user clears extension storage.
• Premium tier: while the account is active. Deleted within 30 days of account deletion.
• Calendar sync tokens: kept while you remain connected. Deleted immediately when you disconnect or delete your account.
• Calendar event data: never stored, so there is nothing to retain. Events are fetched at the moment you view them and discarded after the page renders.
• Backups: rolling 30-day encrypted backups, then purged.

7. Security

• TLS in transit, encryption at rest (provider default).
• OAuth refresh and access tokens for connected calendar accounts are additionally encrypted at the application layer with AES-256-GCM before being written to the database, using a key held only in our hosting environment's secret store.
• No third-party trackers on the extension.
• Periodic security review; see Security.md.

8. Children

TimeRecord is not directed at children under 16. We do not knowingly collect data from children.

9. Changes

We will append new versions to this document. Past versions remain visible.

10. Contact

publisher@webwiz24.com

---

Change log

• 2026-04-26 — v1 drafted (not yet published — placeholder pending domain + backend choice).
• 2026-05-06 — §3 backend locked to Supabase (per ADR-004); §4 sub-processors updated: Vercel removed, Cloudflare added (per ADR-009 — apps/web deploys to Cloudflare Workers via @opennextjs/cloudflare). Still v1 DRAFT pending operating-entity confirmation before publishing.
• 2026-05-29 — Calendar Sync + Google sign-in went live, plus auth polish (display name capture, account deletion via Danger zone). Sections updated:
  • §1 — added a Calendar Sync sub-section documenting OAuth tokens (encrypted at rest) and calendar event metadata (read on demand, never persisted); added "display name" to the web-app data list with its OAuth-or-prompt collection path.
  • §3 — added a Calendar Sync bullet covering token storage location, on-demand event read, and the user-initiated disconnect path.
  • §4 — added Google LLC (Sign in with Google + Calendar API), Microsoft Corporation (Outlook Calendar via Microsoft Graph), and Resend (outbound magic-link email) to the sub-processor table.
  • §5 — added explicit "Disconnect calendar provider" and "Delete account" rights with the in-app paths.
  • §6 — added retention bullets for calendar sync tokens (deleted on disconnect) and calendar event data (never stored).
  • §7 — added explicit AES-256-GCM application-layer encryption note for OAuth tokens. Still v1 DRAFT pending operating-entity confirmation before publishing.
• 2026-06-02 — §3 gained an explicit Operator access (administration) bullet documenting the operator's read access to account-level data (email, plan, subscription status, tracked entities, OAuth tokens) for support / billing / fraud / aggregate analytics purposes. Surfacing this matches the new /admin/* panel that gives the operator a structured view of users, subscriptions, and revenue. Allowlist-gated via ADMIN_USER_IDS; non-admins are redirected. Still v1 DRAFT pending operating-entity confirmation before publishing.
• 2026-06-25 — DRAFT status lifted — v1 published. The operating entity is confirmed as the sole proprietor and the contact address is set to publisher@webwiz24.com (replacing the prior personal placeholder across the Operator line, §5, and §10 Contact). The amber "draft pending operating-entity decision" banner and the DRAFT marker in the version header are removed from apps/web/app/privacy/page.tsx, so https://timerecord.app/privacy now serves an official policy — required for the Chrome Web Store / Edge / AMO listings. No data-practice text changed; only status + contact.
• 2026-06-27 — Google Analytics 4 added to the website (consent-gated). §1 gains a "From the website" subsection documenting consent-gated, IP-anonymized GA4 analytics that load only after the visitor clicks Accept on a cookie banner (Decline loads nothing); §4 sub-processor table extends the Google LLC row to include GA4 website analytics. Implemented as a fully client-side loader + GDPR consent banner (apps/web/app/_components/AnalyticsConsent.tsx) so no analytics cookies/pings fire pre-consent and the static pages stay static. The extension remains analytics-free and tracker-free (§7 unchanged). Shipped alongside a new /blog section, sitemap.xml, robots.txt, and Google Search Console verification meta tag.
• 2026-06-28 — Website analytics now routed through Google Tag Manager + Consent Mode v2 (supersedes the 2026-06-27 direct-GA4 wiring). §1 "From the website" and the §4 Google LLC row are reworded: GA4 is now loaded via a Google Tag Manager container with Google Consent Mode v2, where analytics and advertising storage default to denied, so the container script may load but sets no cookies and sends no measurement data until the visitor clicks Accept (Decline / no choice keeps everything denied). Same client-side consent banner (apps/web/app/_components/AnalyticsConsent.tsx), same static-page posture, same tracker-free extension. Individual Google tags (GA4 today; any future Ads/conversion tags) are configured in the GTM web UI rather than in code. No new data category is collected.
• 2026-06-28 — PostHog added for product analytics (consent-gated, EU region). §1 "From the website" notes PostHog (EU Cloud) loaded through the same Google Tag Manager container and the same consent gate as GA4; §4 sub-processor table gains a PostHog (EU) row. PostHog measures feature usage and drop-off across the website and web app, keyed to the account identifier once signed in. It is gated in GTM on analytics_storage (the same signal the consent banner controls), so it loads nothing until the visitor accepts. No code change — the tag lives in the GTM container. The browser extension stays analytics-free.
• 2026-07-09: Editorial pass. Removed em dashes from the active policy prose (the header and §1 through §10) to match the site's copy style; substituted commas, semicolons, colons, or parentheses so meaning is unchanged. Punctuation only: no change to what data is collected, sub-processors, retention, security, or your rights. The historical change-log entries above are preserved unedited per this file's "never rewrite past versions" rule.